6f1d836fbe2110685eecb1042c24923e8764680cb21b0bdf7d0f151a6c1f0b1a

Analysis

max time kernel
50s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/08/2022, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
Size 867KB
Sample220830-pgln8aabf3
SHA256 6f1d836fbe2110685eecb1042c24923e8764680cb21b0bdf7d0f151a6c1f0b1a
MD5 8f12a68299b80fb68de103b3c54204b1
SHA1 a8e3a9d4793dd0fc3917e35eba870ccfca8132cf
SHA512 76bcb3a277769bc52b4605c411ebd93d5d76588bfb3abd5c49515887d7622f2be07c12688f2e2d86189874b494951e4f73a2cc3a566b88b725e0d831e133048d
SSDEEP 24576:HYZ5VucTm+K/arWA/9lZ93UE16H0E/kv:65VucTmlyrWAtiE16U
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 976	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	27
PID 456 wrote to memory of 976	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	27
PID 456 wrote to memory of 976	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	27
PID 456 wrote to memory of 976	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	27
PID 456 wrote to memory of 1108	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	28
PID 456 wrote to memory of 1108	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	28
PID 456 wrote to memory of 1108	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	28
PID 456 wrote to memory of 1108	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	28
PID 456 wrote to memory of 1180	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	29
PID 456 wrote to memory of 1180	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	29
PID 456 wrote to memory of 1180	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	29
PID 456 wrote to memory of 1180	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	29
PID 456 wrote to memory of 1172	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	30
PID 456 wrote to memory of 1172	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	30
PID 456 wrote to memory of 1172	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	30
PID 456 wrote to memory of 1172	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	30
PID 456 wrote to memory of 1784	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	31
PID 456 wrote to memory of 1784	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	31
PID 456 wrote to memory of 1784	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	31
PID 456 wrote to memory of 1784	456	SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe"
  2⤵
  PID:976
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe"
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe"
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe"
  2⤵
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.15820.30966.exe"
  2⤵
  PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-54-0x0000000000340000-0x000000000041E000-memory.dmp

Download

memory/456-55-0x0000000075D31000-0x0000000075D33000-memory.dmp

Download

memory/456-56-0x0000000000770000-0x0000000000788000-memory.dmp

Download

memory/456-57-0x00000000002E0000-0x00000000002EC000-memory.dmp

Download

memory/456-58-0x0000000007910000-0x00000000079A4000-memory.dmp

Download

memory/456-59-0x0000000002220000-0x000000000225A000-memory.dmp

Download